topic Re: How to match MQTT Protocol and an AWS site in Firewall and Security Management

How to match MQTT Protocol and an AWS site

Trevor_Bruss — Wed, 13 May 2020 16:14:26 GMT

We're trying to allow traffic to a specific AWS site, which unfortunately resolves to several IP addresses and none of which we can control therefore they are dynamic. Initially, we tried creating a Custom Application/Site for this, but that appears to want to match on Web Service traffic. So then we added port 1883 to the "Web Services" that Application Control blade uses. It still isn't matching on our rule which is a source being internal networks, destination is Any, and Services and Applications is this custom app. I'm guessing that won't work as this really isn't "web" traffic in the sense it is not http or https but on a non-standard port.

I see Checkpoint has an application for MQTT Protocol, but I don't know if I want to allow that protocol for Every destination. Is there a way to do this without having to use Dynamic Domain objects in the destination? That is, I want to define an application that goes to specific URL names but the protocol (port) needs to match the MQTT Protocol.

Re: How to match MQTT Protocol and an AWS site

PhoneBoy — Thu, 14 May 2020 18:02:25 GMT

Screenshots of what you did?
Does the URL in question contain the port?

Re: How to match MQTT Protocol and an AWS site

Trevor_Bruss — Thu, 14 May 2020 18:45:53 GMT

Here is an example of the test we can run to determine connectivity.

Here is the rule:

Source is our internal network. And this is what we have for this specific application defined inside of the Everybody_Allowed application group.

I tried multiple things, first of which was to add a service defined for TCP-8883 to the Web Browsing services in the Application Contol and URL Filtering advanced settings. That didn't appear to help. I couldn't find an application for MQTT over TLS but I did see one for MQTT (port 1883) with an application signature. I tried to clone that and specify a different port, but that didn't work likely because it wasn't matching the original application signature.

As this is not normal HTTP/s traffic but is a separate protocol for IoT devices wrapped in a TLS connection (at least that is my understanding of how you can secure MQTT). I wasn't sure if I could define this in a custom application as I've seen other people post on defining an app that doesn't use the default Web Services. Are you suggesting I try adding the port 8889 to the end of the AWS URL in my URL list?

I'm trying to determine how to open all the IPs behind this first AWS Iot URL in the list above, but without having to use some form of dynamic name which requires a reverse lookup. I also don't want to just open the port 8883 to all destinations, which I know will work but seems like the brute method.

Re: How to match MQTT Protocol and an AWS site

PhoneBoy — Thu, 14 May 2020 19:43:00 GMT

If this is not for HTTP/HTTPS traffic, a custom application/site as you've created won't work.
Instead, create an FQDN Domain object which resolves based on forward DNS and use a simple TCP service to allow the relevant traffic.

Re: How to match MQTT Protocol and an AWS site

Trevor_Bruss — Thu, 14 May 2020 19:47:53 GMT

Are there any concerns with using an FQDN Domain object as there were in the past with it consuming resources? I thought every time it gets to the rule it needs to do a DNS lookup? We're running R80.20SP on our gateways.

Re: How to match MQTT Protocol and an AWS site

PhoneBoy — Thu, 14 May 2020 19:51:59 GMT

The main problem in the past was the lack of SecureXL acceleration for Domain objects.
This has been resolved since R80.10.
There will be some additional lookups from the gateways but beyond that, not aware of any specific performance issues.

Re: How to match MQTT Protocol and an AWS site

Darren_Fine — Thu, 25 May 2023 09:31:33 GMT

Hi Trevor_Bruss,

I am trying to assist a customer who wants to limit particular string being published via MQTT protocol.

That string has the test "cloud" in it .

I have tried the attached:

But doesnt seem to block anything.

Not sure if anyone knows how I could achieve this ?

Maybe via IPS or something ?

Let me know

Thanks